Description
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Platforms
Sub-Techniques (5)
Logon Script (Windows)
T1037.002Login Hook
T1037.003Network Logon Script
T1037.004RC Scripts
T1037.005Startup Items
Mitigations (2)
Restrict Registry PermissionsM1024
Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.
Restrict File and Directory PermissionsM1022
Restrict write access to logon scripts to specific administrators.
Threat Groups (4)
| ID | Group | Context |
|---|---|---|
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used a hidden shell script in `/etc/rc.d/init.d` to leverage the `ADORE.XSEC`backdoor and `Adore-NG` ro... |
| G0016 | APT29 | [APT29](https://attack.mitre.org/groups/G0016) has hijacked legitimate application-specific startup scripts to enable malware to execute on system sta... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) has installed an "init.d" startup script to maintain persistence.(Citation: Anomali Rocke March 2019) |
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has attempted to bypass digital signature verification checks at startup by adding a command to the s... |
Associated Software (3)
| ID | Name | Type | Context |
|---|---|---|---|
| S9024 | SPAWNCHIMERA | Malware | [SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has modified the boot process files within `/tmp/coreboot_fs/bin/init` to establish persistenc... |
| S1078 | RotaJakiro | Malware | Depending on the Linux distribution and when executing with root permissions, [RotaJakiro](https://attack.mitre.org/software/S1078) may install persis... |
| S1217 | VIRTUALPITA | Malware | [VIRTUALPITA](https://attack.mitre.org/software/S1217) can persist as an init.d startup service on Linux vCenter systems.(Citation: Google Cloud Threa... |
References
- Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
- Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.
Frequently Asked Questions
What is T1037 (Boot or Logon Initialization Scripts)?
T1037 is a MITRE ATT&CK technique named 'Boot or Logon Initialization Scripts'. It belongs to the Persistence, Privilege Escalation tactic(s). Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initiali...
How can T1037 be detected?
Detection of T1037 (Boot or Logon Initialization Scripts) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1037?
There are 2 documented mitigations for T1037. Key mitigations include: Restrict Registry Permissions, Restrict File and Directory Permissions.
Which threat groups use T1037?
Known threat groups using T1037 include: APT41, APT29, Rocke, UNC3886.